Protecting Customer and Business Data When Using AI (Topic 1) in Module 3 – AI-for-Small-Business (BG)

Protecting Customer and Business Data When Using AI

Small Businesses Are Not Exempt from Data Privacy Law

Small business owners sometimes assume that data privacy regulations apply only to large corporations. This is wrong. Data protection obligations follow the type of data, not the size of the business:

• CCPA (California Consumer Privacy Act) applies to companies collecting personal data from California residents — no size threshold for data brokers; revenue/data thresholds apply for other businesses
• HIPAA applies to any business handling protected health information, regardless of size
• GDPR applies to any business processing personal data of EU residents
• State-level breach notification laws require notifying affected customers if personal data is breached — all 50 US states have such laws

What 'Sending Data to AI Tools' Means

When you paste customer information into ChatGPT, upload a client document to an AI service, or send customer emails through an AI tool, you are transmitting that data to a third-party server. Questions to ask about every AI tool:

1. Does this tool use my inputs for model training? (If yes, your client information could enter AI training datasets)
2. Where is data stored, and for how long?
3. What security certifications does the vendor have? (SOC 2, ISO 27001 are relevant standards)
4. In a breach, what is the vendor's notification timeline?

Practical Small Business Data Rules

• Never paste client PII (names + SSNs, full credit card numbers, medical information) into consumer AI tools without enterprise data agreements
• Anonymize where possible: Replace customer names with "Customer A" in examples you send to AI
• Use enterprise tiers of AI tools for any workflow involving real customer data
• Keep an inventory of which AI tools process which types of data